A UK cryptoasset provider in 2026 complies with two frameworks that are already in force and prepares for a third. Exchanges and custodian wallet providers are registered with the Financial Conduct Authority (FCA) and supervised for anti-money laundering under the Money Laundering Regulations 2017 (the MLRs). Every promotion of cryptoassets to UK consumers must follow the financial promotion rules that have applied since 8 October 2023.
From 25 October 2027, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring trading platforms, dealers, brokers, custodians, UK stablecoin issuers and staking providers into full FCA authorisation. The FCA published its final rules for that regime on 30 June 2026, and its application window is open now, from 30 September 2026 to 28 February 2027.
This guide sets out what each framework requires, what changes at commencement and what a compliance team should be doing now. The authorisation process itself is covered in our UK crypto licence guide.
The table shows each compliance area, its position today and its position once the new regime commences.
| Area | Applies now | From 25 October 2027 |
|---|---|---|
| Money Laundering Regulations | FCA registration and AML supervision | Continue alongside FSMA authorisation |
| Financial promotions | In force since 8 October 2023 | Continue, with authorised firms approving their own promotions |
| FSMA authorisation | Window open 30 September 2026 to 28 February 2027 | Required for each in-scope activity |
| Consumer Duty | Applies to authorised firms only | Applies to relevant retail crypto activity (FG26/5) |
| Conduct of business (COBS) | Promotion rules in COBS 4 | Wider conduct rules by activity |
| Custody (CASS 17) | Not yet in force for crypto | Trust, records, reconciliation and key controls |
| Prudential (COREPRU and CRYPTOPRU) | No capital rules under the MLRs | Capital from £75,000 to £750,000 plus K-factors |
| SM&CR | Not applicable to registered-only firms | Senior managers approved; conduct rules for staff |
| Operational resilience | General expectations | Important business services and tolerances (FG26/6) |
| Admissions and market abuse | Not applicable | CRYPTO 3 disclosures and CRYPTO 4 market abuse rules |
| Complaints (DISP) | Firm's own procedures | FCA complaint handling rules by activity |
Two points shape every transition plan. The final rules apply to firms granted permission on or after 25 October 2027, so the rules are known now and applications are assessed against them. And MLR registration does not convert into FSMA authorisation: every registered firm with in-scope activity must apply.
Until commencement, a cryptoasset exchange provider or custodian wallet provider carrying on business in the UK must be registered with the FCA before it starts trading and must keep complying with the MLRs. The FCA's supervision of registered firms is detailed. It covers ownership, business model, source of funds, customer risk, transaction monitoring and the capability of management.
The FCA reviews an FSMA application against what it already knows from supervision. Open AML findings, weak transaction monitoring or past promotion issues should be resolved before the firm applies, and the application should show how the existing control framework has been extended to the wider FSMA standards.
The FCA has confirmed there will be no automatic conversion and no fast-track for registered firms. A registered firm that wants to keep carrying on in-scope activity applies for the relevant Part 4A permissions, or varies its permission if it is already FSMA-authorised.
The transition work has four parts: map the new regulated activities against what the firm does; decide the permissions and the legal entity that will hold them; check that governance and resources are adequate for an authorised firm; and build the conduct, prudential, client asset and operational frameworks the final rules require. The business plan, forecasts, policies and controls must describe one coherent operating model.
Timing matters. A firm that applies by 28 February 2027 and is still awaiting a decision on 25 October 2027 can continue its business under the saving provision. A firm that applies later and is not authorised by commencement can only perform existing contracts, for up to two years.
The new regime covers seven activities: operating a qualifying cryptoasset trading platform, dealing as principal, dealing as agent, arranging deals, safeguarding qualifying cryptoassets, qualifying cryptoasset staking and issuing a qualifying stablecoin in the UK. The FCA's final rules also apply specific conduct requirements to cryptoasset lending and borrowing.
One platform often needs several permissions. An exchange that holds customer assets operates a platform and safeguards; a broker that executes against its own inventory deals as principal; a staking service that holds customer tokens safeguards and arranges staking. The analysis follows the customer journey and the movement of assets, not the commercial label, and it records which group entity carries on each step.
Overseas firms serving UK consumers are within scope even when they operate from abroad, because the 2026 Regulations treat many activities with UK consumers as carried on in the UK. The structure should be settled before compliance frameworks are written for it.
The compliance build depends on the business. The table shows the main additions each type of provider makes beyond its MLR framework.
| Business model | Main additions from October 2027 |
|---|---|
| Exchange with custody | Platform rules, CASS 17 custody, admissions and market abuse surveillance, £150,000 PMR plus K-factors |
| Broker or OTC desk dealing as principal | Best execution, pre-trade disclosure, conflicts, £750,000 PMR |
| Broker routing orders as agent | Order handling, UK venue requirement, disclosures, £75,000 PMR |
| Custodian wallet provider | CASS 17 trust, records, reconciliations and key controls, K-RCS at 0.04% |
| Staking provider | Staking disclosures and consent, custody where tokens are held, K-CCS at 0.04% |
| UK stablecoin issuer | Full backing, redemption at par, CASS 16, £350,000 PMR and K-SII at 1% |
| Payment firm or EMI adding crypto | A separate FSMA permission for the crypto activity, alongside existing payments obligations |
Every model adds the Consumer Duty for retail customers, SM&CR, operational resilience, complaint handling and the overall risk assessment. The cost and time of the build are driven mostly by custody and trading, where the operational evidence is most detailed.
Since 8 October 2023, promotions of qualifying cryptoassets to UK consumers have been inside the financial promotion regime. A promotion must be communicated by an FCA-authorised firm, approved by one under section 21 of FSMA, or made by an MLR-registered cryptoasset business using the registered firm exemption. Overseas firms are caught where their promotions reach UK consumers, whether or not they are registered in the UK.
A working promotions framework covers websites, apps, social media, influencers, affiliates and referral campaigns, with approval records and version control for every live promotion. From commencement, a firm authorised for cryptoasset activities approves its own promotions, and an unauthorised firm can no longer rely on a section 21 approver for in-scope activity. The FCA has said section 21 approvers should not approve promotions for anyone carrying on regulated activity without permission.
The FCA finalised the application of the Consumer Duty to regulated cryptoasset activities in PS26/13 on 30 June 2026, with non-Handbook guidance in FG26/5. Authorised firms serving retail customers must deliver good outcomes in four areas: products and services, price and value, consumer understanding and consumer support.
Crypto raises particular questions under each outcome. Prices are volatile, the technology is complex, transfers cannot be reversed and the economics of staking or lending can be hard to follow. The FCA expects firms to address these at product design, through the target market, the customer journey and the support model, rather than relying on risk warnings alone.
Outcome monitoring should show whether particular products or customer groups, including vulnerable customers, receive worse outcomes, and the board should review it each year. Our guide to Consumer Duty compliance sets out the annual board report and monitoring framework.
PS26/13 applies relevant parts of the Conduct of Business Sourcebook (COBS) to authorised cryptoasset firms, and PS26/11 adds activity-specific rules in the CRYPTO sourcebook for trading platforms, intermediaries, lending and borrowing, staking and custody. The obligations depend on the activity and the customer, and they are considerably more structured than anything under MLR registration.
Conduct risk sits in order handling, execution, conflicts of interest, pricing, disclosures and product design. A trading platform focuses on fair access and trading rules; a broker on best execution and order handling; a custodian on disclosures and asset protection. Firms using algorithms or automated execution should be able to explain how those systems produce customer outcomes and how errors are detected and corrected.
Policies should map to the firm's future permissions rather than form a generic manual. Compliance monitoring should test both the detailed COBS rule and the customer outcome, because the Consumer Duty works alongside the specific conduct rules and does not replace them.
PS26/11 sets activity-specific conduct rules in the CRYPTO sourcebook. They bring crypto trading close to the standards that apply to traditional trading venues and brokers, adapted to how crypto markets operate.
The FCA has said payment for order flow is unlikely to meet the best execution, conflicts and inducement rules for retail or professional clients. It also intends to consult on extending the deadline for the UK execution venue requirement to January 2028.
PS26/11 confirms retail protections for cryptoasset lending, borrowing and staking, with targeted refinements to the collateral and auto-staking rules. Firms offering these services should design disclosures, consent and loss allocation into the product, and show in the application how customers understand what happens to their assets and returns.
Firms that safeguard qualifying cryptoassets for customers come under CASS 17, set out in PS26/11. It is a significant step beyond MLR registration, which covers custody only from an anti-money laundering perspective.
Custody architecture is both a legal and a technical design. Wallet structures, omnibus arrangements, key management, recovery processes and sub-custody must match the trust and record-keeping framework. Reconciliation breaks must be investigated, evidenced and escalated, never corrected by an unexplained ledger adjustment.
The FCA is not applying CASS 17 to the custody of relevant specified investment cryptoassets (tokenised securities) at this stage; CASS 6 applies to those. CASS 7 applies to client money that arises from safeguarding client cryptoassets.
An authorised firm can use a third-party custodian, but it remains responsible for the assets it has undertaken to safeguard. Arranging for another firm to safeguard client cryptoassets is itself within the safeguarding activity.
Due diligence on a custodian should cover its regulatory status, financial strength, security, operational capability, jurisdiction, insolvency protections and any use of sub-custodians. The contract should support the customer trust structure that the UK rules require. For custody chains outside the UK, the firm should establish how client assets would be treated if the provider became insolvent or access was disrupted, rather than infer it from the provider's reputation.
Oversight continues after appointment. The firm should track the custodian's financial and operational position, test access and recovery, and keep an exit plan that can be executed.
The prudential regime sits in two new sourcebooks: COREPRU, which sets the core framework, and CRYPTOPRU, which adds the crypto-specific requirements. A firm must hold own funds at least equal to the highest of its permanent minimum requirement (PMR), its fixed overheads requirement (FOR) and its K-factor requirement. The FOR is based on the previous year's audited expenditure and represents the cost of an orderly wind-down.
| Activity | Permanent minimum requirement |
|---|---|
| Dealing as principal | £750,000 |
| Issuing a qualifying stablecoin | £350,000 |
| Safeguarding, operating a trading platform or staking | £150,000 |
| Dealing as agent or arranging deals | £75,000 |
K-factors are capital charges that grow with the volume of business. The final coefficients in PS26/12 are:
| K-factor | What it measures | Coefficient |
|---|---|---|
| K-RCS | Client cryptoassets safeguarded | 0.04% |
| K-CCS | Client cryptoassets staked | 0.04% |
| K-SII | Qualifying stablecoins in issue | 1% |
| K-CCO | Client cryptoasset orders | 0.1% |
| K-CTF | Daily cryptoasset trading flow | 0.1% |
| K-NCP | Net cryptoasset position held | 40% of net exposure |
As the FCA's own example shows, a staking firm would need average staked client assets above £375 million before K-CCS exceeded its £150,000 PMR. Cryptoassets that cannot be admitted to a UK platform and prudently valued are deducted from capital in full. Firms must also hold liquid assets, carry out an overall risk assessment and hold more capital where that assessment identifies risks the minimum does not cover.
Forecasts should model how the requirement changes as the business grows, not only the PMR. Prudential calculations, the business plan and the financial data template must use the same assumptions.
A firm issuing a qualifying stablecoin in the UK needs the issuance permission and must meet the rules in PS26/10 and CRYPTO 2. Every coin in issue must be fully backed by eligible assets, redeemable at par, and described in published disclosures. The backing assets are safeguarded under CASS 16, separate from the issuer's own assets, so that holders are protected if the issuer becomes insolvent.
Issuers hold a PMR of £350,000 and the K-SII charge of 1% of average coins in issue, reduced from the 2% proposed in consultation. Liquidity supports redemptions; capital protects the business. The two are related but separate, and the application must show both.
Stablecoins used in payments raise further questions under the payment services and e-money rules. HM Treasury has brought forward amending legislation for certain payment uses of UK-issued qualifying stablecoins, and stablecoin issuers recognised as systemic by HM Treasury come under joint Bank of England and FCA supervision. Our guide to stablecoin payments regulation covers the overlap with EMI and PI licensing.
Authorised cryptoasset firms come under the Senior Managers and Certification Regime (SM&CR). Senior managers need FCA approval before they take up their roles, each has a statement of responsibilities, and staff in certified roles are assessed by the firm as fit and proper. The conduct rules apply to almost all staff.
Responsibilities should be allocated clearly across governance, financial crime, prudential risk, custody, operational resilience and customer outcomes. Boards need enough technical understanding to challenge the people and suppliers running wallet infrastructure, key management and trading systems, and regulatory, financial and technical governance should work as one.
Our guide to SM&CR in 2026 explains the approval process, responsibilities maps and certification.
The FCA issued FG26/6 on cryptoasset operational resilience alongside PS26/13. Crypto firms depend on wallet infrastructure, blockchain nodes, cloud services, identity providers, market data and many third parties, and disruption can reach every customer at once.
Authorised firms identify their important business services, map the people, technology and suppliers behind each, set impact tolerances for the maximum disruption customers can bear, and test that they can stay within them. Scenarios should include crypto-specific events: compromise of a private key, chain congestion, a protocol fork or outage, loss of blockchain connectivity, the insolvency of a third-party custodian and a major cyber incident.
Outsourcing does not move responsibility. Firms should understand concentration, sub-outsourcing and exit, and keep enough internal capability to supervise their providers.
PS26/9 creates two new regimes. Under CRYPTO 3, a cryptoasset admitted to a UK qualifying cryptoasset trading platform needs a qualifying cryptoasset disclosure document, and the platform carries out due diligence and applies admission standards. Under CRYPTO 4, the market abuse regime for cryptoassets prohibits insider dealing, unlawful disclosure of inside information and market manipulation.
Trading platforms and intermediaries need surveillance of orders and transactions proportionate to their activity, adapted to crypto patterns such as wash trading, spoofing and pump-and-dump schemes. Suspicious orders and transactions are reported to the FCA. Automated surveillance generates many alerts, so firms need calibrated models, trained analysts and governance that separates real concerns from ordinary market behaviour. Market abuse monitoring should connect with financial crime controls where behaviour raises wider criminal concerns.
Authorised crypto firms apply the FCA's complaint handling rules in the Dispute Resolution sourcebook (DISP) to their regulated activities. That means written procedures to receive, investigate, resolve and record complaints, and clear information to eligible complainants about referring a complaint to the Financial Ombudsman Service where the activity falls within its jurisdiction.
Customer-service tickets do not automatically meet the regulatory definition of complaint handling. Complaint data should feed Consumer Duty monitoring: recurring complaints about withdrawals, account freezes, execution, custody or fees call for root-cause analysis and, where needed, remediation or product change.
Irreversible on-chain transactions do not remove the duty to investigate. The firm examines whether its own systems, communications or controls contributed to the customer's loss, and contract terms cannot remove a responsibility the rules place on the firm.
FSMA authorisation adds conduct and prudential rules and leaves the anti-money laundering, sanctions and fraud obligations in full. The MLRs continue to apply, and the FCA's financial crime expectations in SYSC apply to authorised firms.
A complete framework includes the business-wide risk assessment, customer risk methodology, due diligence, ongoing monitoring, blockchain analytics, transaction monitoring, travel rule compliance, sanctions screening and suspicious activity reporting, covering both on-chain and off-chain activity. Blockchain analytics support judgement rather than replace it: firms should understand each tool's method and limits, calibrate its thresholds and investigate alerts in context, with extra analysis for self-hosted wallets and cross-chain activity.
The travel rule deserves its own procedures. For each transfer the firm collects and sends the originator and beneficiary information required by Part 7A of the MLRs, checks the information received on incoming transfers, and decides how to handle transfers from firms in countries that have not yet implemented the rule and transfers to or from self-hosted wallets.
Financial crime controls connect with custody, trading and the Consumer Duty. A decision to restrict an account after an alert, for example, affects customer support and complaints and needs a governed process. Our guide to FCA financial crime compliance covers the full set of expectations.
The FCA's approach to international cryptoasset firms, FG26/7, expects a firm needing authorisation to operate through a UK legal entity with real UK presence. A sufficient share of leadership and decision-making should sit in the UK, and senior managers involved in UK activities should spend adequate time here. A UK branch alone is generally not accepted, mainly because UK client asset protections may not hold if an overseas firm becomes insolvent.
Two exceptions apply. The FCA sees a case for operating a trading platform through a UK branch where it gives UK customers access to global liquidity and the home regulator offers comparable protection; a letter of good standing alone is not enough. Firms regulated by both the PRA and the FCA may also be able to use a branch, case by case.
An overseas licence, including a MiCA authorisation, does not passport into the UK. Groups should map which entity contracts with customers, controls assets, runs technology and makes regulated decisions. Intra-group outsourcing works where the UK firm retains authority, information and capability, and capital, governance, tax, contracts and technology are designed together.
Authorisation begins continuous supervision. The board owns the compliance framework and should receive regular management information on customer outcomes, financial crime, capital and liquidity, client assets, operational incidents and complaints.
New controllers need FCA approval before they acquire control, new senior managers need approval before they take up their roles, and new regulated activities need a variation of permission. Material changes to outsourcing, custody arrangements or the business model are notified in advance. A firm that keeps its application documents current through the review is well placed to meet these obligations from the first day.
| Period | Priority for compliance teams |
|---|---|
| Now to December 2026 | Gap assessment against the final rules; permission matrix; board-approved implementation plan |
| By 28 February 2027 | Complete FSMA application submitted on FCA Connect to qualify for the saving provision |
| March to September 2027 | Answer FCA information requests; build CASS 17, prudential reporting, SM&CR and Consumer Duty frameworks |
| 31 July 2027 | Last practical date for any new MLR registration application |
| 25 October 2027 | Regime commences; operate under permission, the saving provision or the transitional provision |
| First year after authorisation | First Consumer Duty board report, client assets audit, regulatory returns and periodic fees |
Support for crypto gap assessments and ongoing compliance is described on our regulatory compliance page.
Exchanges and custodian wallet providers must be registered and supervised under the Money Laundering Regulations, and promotions to UK consumers must meet the financial promotion rules. The FSMA authorisation regime commences on 25 October 2027, and its final rules were published on 30 June 2026.
No. Registration does not convert into a Part 4A permission. Firms carrying on in-scope activity must apply, ideally inside the window that closes on 28 February 2027.
Yes, to authorised firms carrying on relevant retail cryptoasset activity. The FCA set out its approach in PS26/13 and the FG26/5 guidance.
CASS 17 is the FCA's client asset chapter for firms safeguarding qualifying cryptoassets. It covers trust arrangements, records, reconciliations, key and access controls and third-party custodians.
The permanent minimum is £75,000 for arranging and dealing as agent, £150,000 for custody, trading platforms and staking, £350,000 for stablecoin issuance and £750,000 for dealing as principal. Fixed overheads and K-factors can raise the requirement.
Generally not. FG26/7 expects a UK legal entity with real UK presence; operating a trading platform through a UK branch is the main exception.
Promotions need a lawful route, a prescribed risk warning, a 24-hour cooling-off period for first-time investors, an appropriateness assessment and no incentives to invest. They have applied since 8 October 2023.
Buckingham Capital Consulting has obtained FCA authorisations since 2013 for firms including Dzing Finance and HFS (EMI), Orbital (API) and Moneliq (variation of permission), and supports cryptoasset providers with MLR compliance, financial promotions and preparation for the FSMA regime. Its gap assessments turn the FCA's final crypto rules into a costed, board-approved programme for authorisation and ongoing compliance.
Speak to an expert: WhatsApp +44 7563 115980, Telegram @buckinghamcapital or info@buckinghamcapitalconsulting.co.uk.
This article is general information, reviewed against the regulator’s published requirements on the date shown. It is not legal advice; the regulator’s current publications take precedence.